Onboard, parse, and normalize data from syslog, agents, cloud provider logs, SaaS APIs, identity (Microsoft Entra ID, Okta), EDR, and network sources into common schemas (OCSF, Splunk CIM, Elastic ECS, Google UDM)
Build reduction, filtering, enrichment, and tiering strategies that send only high value data to premium analytics platforms, keep full fidelity copies in low cost storage, and support replay on demand
Quantify the business cases of baseline ingest, model savings, and present before and after results to technical and financial stakeholders
Size and harden deployments, including worker topology, high availability and disaster recovery, queuing and backpressure, and fleet health monitoring, across on-premises, cloud, hybrid, and regulated environments
Build governance into the data flow with masking and redaction of sensitive data, role-based access control, TLS/PKI, and retention policy
Lead the data workstream of SIEM and platform migrations (for example Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike Falcon Next-Gen SIEM, SentinelOne AI SIEM)
